Merge PR #17: enh forms

craft/src/components/basic/SearchBar.toHtml.test.ts

@@ -30,3 +30,46 @@ describe('SearchBar.toHtml XSS hardening (placeholder/buttonText/showButton)', (
     expect(html).toMatch(/border-radius:(8px 0 0 8px|8px)/);
   });
 });
+
+// F2: SearchBar was purely decorative -- no action/method/input name, so
+// submitting did nothing. It now emits a real GET form.
+describe('SearchBar.toHtml is a functional GET search form (not decorative)', () => {
+  test('defaults to a GET form action="/" with the query input named "q"', () => {
+    const { html } = toHtml({}, '');
+    expect(html).toMatch(/<form role="search" action="\/" method="GET"/);
+    expect(html).toContain('<input type="search" name="q"');
+  });
+
+  test('a configured action (real search-results page) is used verbatim', () => {
+    const { html } = toHtml({ action: '/search' }, '');
+    expect(html).toContain('action="/search"');
+  });
+
+  test('a javascript: action is blocked via safeUrl and falls back to "/"', () => {
+    const { html } = toHtml({ action: 'javascript:alert(1)' }, '');
+    expect(html).toContain('action="/"');
+    expect(html).not.toContain('javascript:');
+  });
+
+  test('an empty/whitespace action falls back to "/"', () => {
+    const { html } = toHtml({ action: '   ' }, '');
+    expect(html).toContain('action="/"');
+  });
+});
+
+describe('SearchBar.toHtml box-model style passthrough', () => {
+  test('margin/border/box-shadow/opacity flow through via the style prop', () => {
+    const { html } = toHtml({ style: { marginBottom: '14px', border: '1px solid #aaa', boxShadow: '0 1px 4px rgba(0,0,0,.1)', opacity: '0.9' } }, '');
+    expect(html).toContain('margin-bottom:14px');
+    expect(html).toContain('border:1px solid #aaa');
+    expect(html).toContain('opacity:0.9');
+  });
+});
+
+describe('SearchBar.craft.props includes animation/visibility defaults', () => {
+  test('has blank/false defaults', () => {
+    expect(SearchBar.craft!.props).toMatchObject({
+      animation: '', animationDelay: '', hideOnDesktop: false, hideOnTablet: false, hideOnMobile: false,
+    });
+  });
+});

craft/src/components/basic/SearchBar.tsx

@@ -1,19 +1,29 @@
 import React, { CSSProperties } from 'react';
 import { useNode, UserComponent } from '@craftjs/core';
 import { cssPropsToString } from '../../utils/style-helpers';
-import { escapeHtml, escapeAttr } from '../../utils/escape';
+import { escapeHtml, escapeAttr, safeUrl } from '../../utils/escape';
 
 interface SearchBarProps {
   placeholder?: string;
   buttonText?: string;
   showButton?: boolean;
+  /** Where the search GET request is submitted -- a real search-results page
+   *  if the site has one, or '/' (site root) by default. The query is sent
+   *  as `?q=...`, the conventional param name search-results pages look for. */
+  action?: string;
   style?: CSSProperties;
+  animation?: string;
+  animationDelay?: string;
+  hideOnDesktop?: boolean;
+  hideOnTablet?: boolean;
+  hideOnMobile?: boolean;
 }
 
 export const SearchBar: UserComponent<SearchBarProps> = ({
   placeholder = 'Search...',
   buttonText = 'Search',
   showButton = true,
+  action = '/',
   style = {},
 }) => {
   const {
@@ -27,6 +37,8 @@ export const SearchBar: UserComponent<SearchBarProps> = ({
     <form
       ref={(ref: HTMLFormElement | null): void => { if (ref) connect(drag(ref)); }}
       role="search"
+      action={action}
+      method="GET"
       onSubmit={(e) => e.preventDefault()}
       style={{
         display: 'flex',
@@ -51,6 +63,7 @@ export const SearchBar: UserComponent<SearchBarProps> = ({
         />
         <input
           type="search"
+          name="q"
           placeholder={placeholder}
           style={{
             width: '100%',
@@ -101,7 +114,13 @@ SearchBar.craft = {
     placeholder: 'Search...',
     buttonText: 'Search',
     showButton: true,
+    action: '/',
     style: {},
+    animation: '',
+    animationDelay: '',
+    hideOnDesktop: false,
+    hideOnTablet: false,
+    hideOnMobile: false,
   },
   rules: {
     canDrag: () => true,
@@ -117,6 +136,7 @@ SearchBar.craft = {
     placeholder = 'Search...',
     buttonText = 'Search',
     showButton = true,
+    action = '/',
     style = {},
   } = props;
 
@@ -133,11 +153,19 @@ SearchBar.craft = {
     ? `<button type="submit" style="padding:12px 20px;font-size:15px;font-weight:600;font-family:Inter,sans-serif;color:#ffffff;background-color:#3b82f6;border:none;border-radius:0 8px 8px 0;cursor:pointer;white-space:nowrap;display:flex;align-items:center;gap:6px"><i class="fa fa-search" style="font-size:13px" aria-hidden="true"></i>${escapeHtml(buttonText)}</button>`
     : '';
 
+  // F2: previously a purely decorative <form> -- no action/method/input
+  // name at all, so submitting did nothing. A real GET to `action` with the
+  // query in the conventional `q` param makes this a functioning search
+  // form on publish (routes to a real search-results page if the site has
+  // one, or reloads '/' with ?q=... by default). `safeUrl` blocks
+  // javascript:/vbscript:/data:text/html breakout via the action attribute.
+  const actionAttr = escapeAttr(safeUrl(action) || '/');
+
   return {
-    html: `<form role="search"${formStyle ? ` style="${formStyle}"` : ''}>
+    html: `<form role="search" action="${actionAttr}" method="GET"${formStyle ? ` style="${formStyle}"` : ''}>
   <div style="position:relative;flex:1">
     <i class="fa fa-search" style="position:absolute;left:14px;top:50%;transform:translateY(-50%);color:#9ca3af;font-size:14px;pointer-events:none" aria-hidden="true"></i>
-    <input type="search" placeholder="${escapeAttr(placeholder)}" style="${inputStyleStr}" />
+    <input type="search" name="q" placeholder="${escapeAttr(placeholder)}" style="${inputStyleStr}" />
   </div>
   ${btnHtml}
 </form>`,